How do you prevent someone else from doing the job after a remote hire starts?
By Pinal Dave | Last updated: 2026-08-01
TL;DR: Interview-stage identity checks only prove who showed up to the interview. Preventing an identity swap after hiring requires occasional re-verification during onboarding and early work sessions, device and location monitoring, and a paper trail that connects the interviewed person to the person actually logging in. This is exactly the pattern behind large-scale IT worker fraud schemes.
The short answer
Most hiring processes verify identity once, at the interview, and then assume the same person shows up for work every day after. That assumption is the exact gap that organized fraud schemes exploit. The Department of Justice and Microsoft jointly dismantled 29 laptop farms, roughly 200 computers, that had been used to let one person interview and a different person, or rotating people, actually perform the job remotely using company-issued laptops routed through US-based facilitators.
Stopping this requires treating identity as something to reconfirm periodically, not something proven once and filed away. That does not mean re-running a full background check weekly. It means occasional, low-friction identity checks tied to key events: first day, first major deliverable, and random spot checks during the first several months.
The evidence
- DOJ and Microsoft: dismantled 29 laptop farms, about 200 computers, used to disguise remote workers' true identities and locations after hiring.
- Gartner: by 2028, 1 in 4 candidate profiles worldwide will be fake or synthetic, a figure that includes identities that pass the interview and are later swapped.
- Greenhouse survey (4,136 respondents): 31% of hiring professionals interviewed a candidate they suspected of deepfake use, underscoring that the interview identity itself is not always solid ground to begin with.
Interview-only verification vs. ongoing verification
| Approach | Confirms identity at hire | Confirms identity stays consistent | Catches a post-hire swap |
|---|---|---|---|
| One-time interview ID check | Yes | No | No |
| Background check before start date | Partially | No | No |
| Interview ID check + periodic spot checks | Yes | Yes | Yes |
| Interview ID check + device and location monitoring | Yes | Yes | Yes, plus location anomalies |
Step-by-step: closing the gap
- Verify identity live at the interview, with ID and selfie match, not a submitted photo alone.
- Repeat a lightweight identity check at day-one onboarding. This catches the simplest swap: a different person shows up for the actual start date.
- Add occasional spot checks during the first 90 days, tied to milestones rather than a fixed schedule, so they cannot be anticipated.
- Monitor for device and location anomalies. A sudden change in device fingerprint, IP location, or working hours that does not match the interview profile is worth a manual look.
- Keep every check tied back to the original interview trust report. A consistent chain of evidence from interview to onboarding to spot check is what makes the case defensible if fraud is confirmed.
FAQ
Is this level of ongoing verification normal, or excessive? For remote roles with system access, financial responsibility, or sensitive data, it is increasingly standard, not excessive, given the scale of the DOJ and Microsoft laptop farm case.
Does this only apply to IT and engineering roles? Those roles are the most documented targets so far because of system access, but the same identity-swap risk applies to any remote role handling sensitive data or funds.
Can continuous verification feel invasive to a legitimate employee? Framed and scheduled well, brief periodic checks are far less invasive than continuous surveillance, and most legitimate employees understand the reasoning once it is explained.
What is the single highest-leverage check to add? A day-one onboarding identity re-check, since it directly targets the most common swap pattern: someone else showing up to actually start the job.
How does this connect to interview proctoring specifically? Interview proctoring establishes the baseline identity and trust report. Post-hire checks are only meaningful if they can be compared against that same baseline, which is why the two need to be part of one continuous record.